Summary
- In the first half of 2026, CertiK identified 52 incidents of "wrench attacks"—physical coercion of crypto owners—globally, an increase from 39 the previous year.
- The total financial exposure rose sharply to $124.1 million, compared to $10.5 million in H1 2025.
- Europe comprised 75% of these cases, with France alone accounting for 33 out of the 52 incidents.
According to a recent report by blockchain security firm CertiK, there has been a significant escalation in violent attacks targeting cryptocurrency holders, leading to a dramatic increase in the financial stakes involved.
CertiK confirmed that there were 52 "wrench attacks"—where criminals resort to violence or threats to extract crypto—from January to June 2026, a rise of 33.3% from 39 incidents in the same period last year. The total financial impact soared nearly 12 times to $124.1 million, up from $10.5 million in H1 2025, resulting in an increase in the average amount taken per incident from $270,000 to $2.39 million.
The CertiK Intel3D H1 2026 Wrench Attacks Report is available now.
Crypto-related crime has turned violent.
Our latest findings reveal:
• 52 verified wrench attacks (+33.3% YoY)
• $124.2M in financial exposure
• Home invasions have become the primary attack methodFor the full report and more… pic.twitter.com/KoEAfQFMRL
— CertiK (@CertiK) July 22, 2026
CertiK warned that these statistics include both ransom demands and assets that have been frozen or recovered, indicating that the actual number of stolen assets could be significantly higher due to victims' reluctance to report incidents out of fear of retaliation or damage to their reputation.
The report highlights a notable trend towards an increase in home invasions, which have escalated from just one reported case in H1 2025 to 20 in the first half of 2026, making up approximately 41% of all incidents. Attackers are increasingly targeting not just the individual but also their home, family, and mental state during these confrontations. Kidnapping incidents also rose, going from 12 to 16 cases, while one murder was recorded in both periods.
Global Overview of Crypto Wrench Attacks
On a geographical scale, the situation has developed into a significant crisis in Western Europe. Europe accounted for 75% of all verified wrench attacks, with France alone responsible for 33 incidents—about 64% of the global total. CertiK attributes France's high incidence rate to its prominent and visible crypto market, coupled with a series of data breaches, such as those involving France Travail and ANTS, which provided attackers with ready-made lists of potential targets.
CertiK also noted a shift towards a more organized and professional model of crime, where leaders procure data and manage operations while employing disposable, often young accomplices recruited through messaging apps. These groups now create "target packages" from leaked databases and transaction histories, suggesting that minimizing data exposure is becoming a vital aspect of personal safety.
This evolving threat landscape is prompting changes in security recommendations. CertiK highlighted that while hardware wallets or concealed seed phrases may offer some protection, they are ineffective if the owner is coerced into revealing access—leading the firm to advocate for multi-signature wallets, withdrawal delays, and family protocols for handling duress situations.
The report underscores a continuing upward trend in wrench attacks, with incidents increasing each year. In 2025, CertiK documented 72 attacks throughout the entire year, marking a 75% increase compared to 2024. The most shocking case that year involved the January kidnapping of Ledger co-founder David Balland and his spouse in France, where their captors resorted to severing one of Balland's fingers to demand a multi-million-euro ransom before they were rescued by law enforcement.
The trend of targeting family members has become a hallmark of the surge in France. In February, six individuals, including a minor, were apprehended after abducting a magistrate and her mother in a crypto ransom scheme. Later, two teenagers faced charges for attempting to kidnap the wife of The Sandbox co-founder Sébastien Borget using a fake firearm and restraints, until they were thwarted by neighbors and forced to flee.
The scale of these attacks has prompted a strong response from authorities. By April, French prosecutors had charged 88 suspects—over ten of whom were minors—across 12 separate investigations. French officials committed to implementing measures to safeguard crypto holders, including regular welfare checks at the homes of executives.